Business Names Registration Regulations 2011

Domain name form. The Regulations hinge on the concept of a “domain name form” of a registered business name. This is not separately defined in the Regulations, but the notes to reg 4 make the meaning clear: if the registered business name is “Fred’s Fish”, the domain name form “fredsfish.com.au” is a permitted variant. Critically, the Regulations do not grant rights to third-party domain names; the safe harbour applies only to domain names that the entity actually holds and is not prevented from using. Regulation 4(2) and reg 5(2) extend this to names resulting from removing host names (e.g. “www”) or domain extensions (e.g. “.com”, “.org”), so that a business registered with “fredsfish.com.au” can lawfully trade using “fredsfish.com” or “Freds Fish” without triggering the s 18(1) offence. However, the note to reg 4(1)(b) warns that holding a domain name form does not guarantee access to all variants - another entity might own “fredsfish.org”, which the first entity is “prevented from using” and therefore cannot rely on the exception.

Alternative contact details. Defined in reg 3 as contact details that are (a) provided by the entity voluntarily, (b) not required by the Act or Regulations, and (c) provided for use by ASIC or a government body under s 62 of the Act. These are optional supplementary details (e.g. an email address not already mandated). The key consequence is that alternative contact details are excised from copies of Register entries given to the public (reg 9(b)) but must be made available to government bodies and intelligence agencies in full (reg 11). This creates a two‑tier regime: voluntary data subject to heightened privacy protection from the public, but full exposure to the state.

Notified successor. A person or entity nominated under s 40 of the Act to inherit the business name after the death of the registered holder. Regulation 8 prescribes additional details ASIC may record: contact details, alternative contact details, how the successor will inherit assets, relationship to the deceased, date and place of birth, and ABN. These details are more intrusive than for ordinary holders - notably the asset inheritance method and relationship. For public access, reg 9(e) removes the inheritance method, relationship, and date/place of birth from any copy given to a person, but again (via reg 11) all those details are available to government bodies.

Carrying on a business under an unregistered business name - offence does not apply. The Act’s s 18(1) makes it an offence to carry on a business under a business name that is not registered. The Regulations in reg 4 specify two circumstances where that offence is disapplied: (1) using the domain name form of a name that is registered to the entity, and (2) using a name that is obtained by stripping host names/domain extensions from a registered domain name. These are not defences - they are “circumstances” that remove the offence entirely if the conditions are met. The same structure applies to the written communications offence (reg 5) and the display offence (reg 6).

Register details. The Regulations distinguish between three layers of information: (a) mandatory details in the Register under s 33(1) of the Act, (b) prescribed additional details under reg 7 (contact details, home address, birth date/place, status flags), and (c) publicly available information under reg 10 (a narrower set - no home address beyond suburb/state, no birth date, no alternative contact details). This tiered system reflects the legislature’s judgment that some data is necessary for registry integrity but should not be broadcast to the world.

Principal place of business vs home address. When an individual uses their home address as their principal place of business, reg 10(2) and reg 9(d) require that ASIC publicly release only the suburb and state/territory, and excise the full address from copies provided on request. The Act’s default position (s 33(1)(c) requires the principal place address) is thus tempered by a privacy carve‑out in the Regulations.

The Regulations directly affect every entity that registers a business name under the Act - individuals, companies, partnerships, trusts, unincorporated associations, and joint registrants. Because the Regulations define the scope of exceptions to the Act’s offences, any person carrying on business in Australia under a name that is registered (or using a variant of that name) must understand the safe harbours in regs 4, 5 and 6. Failure to meet those conditions, or misunderstanding what constitutes a “domain name form” that the entity is not prevented from using, could expose the entity to the s 18(1) offence of carrying on business under an unregistered name, even if the entity holds the core registration.

Individual business owners are particularly affected by the privacy provisions. Regulation 7(c) allows ASIC to include the home address of an individual in the Register; reg 10(2) limits public disclosure to suburb and state/territory, but reg 11 requires full disclosure to government bodies and intelligence agencies. Any individual who provides a home address as their principal place of business should know that the address will be shared with government agencies without further consent.

Notified successors - often family members or business associates of a deceased business owner - are affected by reg 8, which prescribes that ASIC may record intimate details (relationship to deceased, expected inheritance mechanism) and that these details are not publicly available (reg 9(e) excises them) but are available to government bodies under reg 11. This imposes a compliance cost: a person nominated as notified successor must provide accurate information or risk the nomination being invalid, potentially disrupting business continuity.

ASIC is the primary regulator affected. The Regulations impose specific duties on ASIC: it must exercise the prescribed powers delegated by the Minister (reg 13 - functions under ss 27(2), 28(2), 32(3) of the Act and certain powers under the Business Names Registration (Availability of Names) Determination 2015); it must keep documents for seven years before destruction (reg 12); it must excise specified details before providing copies (reg 9); it must make certain details publicly available free of charge (reg 10); and it must make all Register details available to government bodies on request (reg 11). The delegation provision (reg 13) indirectly affects entities applying for review of decisions or name availability determinations, because the delegate may be an ASIC officer rather than the Minister, potentially changing appeal paths.

Government bodies and intelligence/security agencies are express beneficiaries: reg 11 entitles them to the full Register without the redactions applied to the public. This wide access may affect entities’ expectations of privacy - voluntary provision of alternative contact details or an individual’s birth date cannot be kept from government.

Practitioners advising clients on business name usage must be alert to the domain name variants. An entity that rebrands from “Fred’s Fish” to “fredsfish.com” without checking whether it holds that domain name risks committing an offence if it ceases to hold the exact registered name. The Regulations do not require the entity to have registered the domain name as a business name; they only require that the underlying business name is registered and that the entity is not prevented from using the domain name. This places the onus on the entity to verify domain ownership and any contractual or intellectual property restrictions.

Right to use domain name variants. The Regulations confer a right on registered business name holders to carry on business under a domain name form of their registered name without separately registering that domain name (reg 4). This right is conditional: the domain name must be registered to the entity (not just held by it - “registered” is used in the technical sense of domain registration) and the entity must not be prevented from using it (e.g. by a trade mark opposition or contractual term). The same right extends to names formed by removing host names or domain extensions. This is a defence, not a licence: if ASIC prosecutes for carrying on business under an unregistered name, the entity bears the evidentiary burden of showing the conditions are met.

Right to include domain name variant in written communications. Regulation 5 permits the entity to include a domain name form (or stripped variant) in business documents - such as invoices, receipts, or advertisements - and still satisfy the s 19(1) obligation to include the business name. This avoids the impracticality of having to display “Fred’s Fish” when the entity trades online as “fredsfish.com.au”. However, the entity must ensure the document clearly refers to the domain name; if the document uses any other name not registered, the offence may still apply.

Right to display domain name variant at public premises. Regulation 6 similarly permits the entity to prominently display a domain name form (or stripped variant) at places open to the public, rather than the exact registered name. The display must be at every place open to the public where the business is carried on - a brick‑and‑mortar shop must display the name, but an online‑only business may not have a physical public premises to which the duty attaches.

Duty to avoid using unregistered variants. There is no positive duty in the Regulations to use a domain name form; the Regulations only provide exceptions. An entity that uses a domain name that is not a domain name form of its registered name, or that is prevented from using it, is not protected and may commit the s 18(1) offence. This imposes a monitoring duty on the entity to check that any name it trades under corresponds to a domain it holds.

Right to provide alternative contact details. An entity may voluntarily provide alternative contact details to ASIC (reg 3 definition). The right is to have these recorded on the Register (reg 7(b)), but with the important limitation that they will not be disclosed to the public on request (reg 9(b)), though they will be shared with government bodies (reg 11). This creates a right to communicate privately with ASIC without public exposure.

Right to limited public disclosure of home address. Individual business owners have the right under reg 10(2) to have their home address publicly revealed only to suburb and state/territory. This is mandatory - ASIC “must only make publicly available the suburb and the State or Territory”. However, this right is not absolute for government requests: reg 11 requires ASIC to make all details available to government bodies, including the full home address.

Right of notified successors to privacy of certain details. The Regulations give notified successors the right not to have their relationship, expected inheritance method, or birth date disclosed to the public (reg 9(e)). These are excised from copies. But again, reg 11 overrides this for government agencies.

Duty of ASIC to excise. ASIC has a positive duty under reg 9 to excise prescribed details from any copy of a Register entry before giving it to a person. This is a limitation on the right of public access (s 60 of the Act gives a right to obtain copies, but subject to excision). Failure by ASIC to excise would breach the Regulations and potentially give rise to administrative law remedies.

Right of government bodies to full access. Under reg 11, ASIC must make all Register details available to government bodies and intelligence/security agencies. This is a right held by those bodies, not a duty. Entities cannot object to this disclosure - the Regulations contain no opt‑out.

The Regulations themselves do not create new penalties or offences. Instead, they define circumstances in which offences under the Act do not apply. The primary offences reside in the Act:

• s 18(1): carrying on business under an unregistered business name (maximum penalty 60 penalty units, currently $13,320 for an individual or $66,600 for a body corporate, though the Act may index).
• s 19(1): failing to include the business name in business documents (penalty 10 penalty units).
• s 20(1): failing to display the business name at premises open to the public (penalty 10 penalty units).

The Regulations do not affect enforcement procedures or evidentiary standards. If a prosecutor charges an entity under s 18(1), the entity may rely on reg 4 as making the offence “not apply”. The note structure in the Regulations (using “Note:” for examples, not operative text) means the operative provisions are regs 4(1), 4(2), 5(1), 5(2), and 6. These operate by deeming the offence not to exist in the specified circumstances. The practical effect is that a court would acquit if the entity proves the conditions. Because the Regulations use “does not apply” rather than “it is a defence”, the burden may be on the prosecution to prove that the circumstances are absent, analogous to an element of the offence. However, the language of s 18(2)(h) of the Act (which gives the regulation‑making power) says the regulations may prescribe “circumstances in which the offence does not apply”. This suggests the circumstances are jurisdictional rather than defensive - if they exist, the prosecution cannot succeed.

Compliance with the domain name exceptions is not self‑executing. An entity relying on reg 4 must keep evidence that the domain name is registered to it (e.g. Whois records or domain registration certificates) and that it is not prevented from using it (e.g. no court order, no trade mark infringement letter). Without such evidence, an entity faces potential prosecution and must defend on the merits.

The Regulations also affect enforcement indirectly through the notification provisions in reg 14. If an entity has ceased to exist (e.g. deregistered company, wound‑up trust), ASIC can give valid notice to prescribed persons - liquidators, former directors, nominated contacts. This means that enforcement actions (such as cancellation of registration for non‑payment or failure to renew) can proceed even if the entity is defunct, and the person receiving notice may be personally affected (e.g. a former director could be forced to respond). Failure to respond could lead to cancellation without input.

The Regulations impose no monetary penalties for non‑compliance with the register provisions. Breach by ASIC of its duties under reg 9 (failure to excise) or reg 10 (failure to make publicly available) might give rise to judicial review under the Administrative Decisions (Judicial Review) Act 1977 or an application for mandamus, but the Regulations do not attach financial sanctions. Similarly, an entity that provides false alternative contact details may not face a penalty under the Regulations alone, but could be subject to the Act’s general offence provisions (e.g. providing false information to ASIC - s 136 of the Corporations Act if an Australian company).

In summary, enforcement risk for business owners is concentrated in the underlying Act offences. The Regulations reduce that risk for those using domain name variants, but introduce new traps for those who misinterpret what domain names they are “not prevented from using”. For ASIC, enforcement risk is administrative - failing to apply the excision rules could lead to litigation.

The Regulations sit directly beneath the Business Names Registration Act 2011 (Cth). Every regulation cites the specific subsection of the Act that authorises it (e.g. reg 4 cites para 18(2)(h) of the Act, reg 7 cites s 33(7)). The Act itself interacts with the Corporations Act 2001 (Cth) and the ABN system, and the Regulations reflect those connections.

Corporations Act. Regulation 14(2) borrows the definition of “deregistered” from s 9 of the Corporations Act. This means that when ASIC gives notice to a deregistered company’s former directors (item 2 of the table in reg 14(1)), it relies on the Corporations Act definition, which includes voluntary deregistration under s 601AA or ASIC‑initiated deregistration under s 601AB. The notice mechanism ensures that directors remain contactable for business name matters after the company disappears - a significant interaction because directors may believe their obligations end with deregistration.

Business Names Registration (Transitional and Consequential Provisions) Act 2011 and Regulations. The transitional Act preserved state and territory business name registrations and allowed for suppression of previously restricted personal information. Regulation 9 notes that personal information previously suppressed under state or territory laws cannot be disclosed in copies of entries. Regulation 7(2) cross‑references the transitional regulations for additional register details. Regulation 10(1)(l) includes “any word or expression nominated by ASIC in accordance with item 18 of Schedule 1” to the transitional Act - a mechanism for preserving historical data. Entities that migrated from state registers have legacy rights to suppression that persist under the Regulations.

Business Names Registration (Availability of Names) Determination 2015. Regulation 13(b) delegates the Minister’s functions under ss 9(1) and (2) of that Determination - powers relating to availability of names - to ASIC. This means that decisions on whether a proposed name is available for registration (including acceptability and restricted words) can be made by ASIC delegates rather than the Minister, streamlining administration but shifting accountability.

Privacy law. The Regulations operate as an exception to the Privacy Act 1988 (Cth) for the public register. The Australian Privacy Principles (APPs) generally limit collection, use, and disclosure of personal information. However, the Act and Regulations authorise ASIC to collect, use, and disclose personal information (name, address, birth date) for the purpose of the business names register. Regulation 11’s requirement to share all details with government bodies overrides any APP‑based objection an entity might raise. The Regulations also create a privacy protective layer by excising birth dates, home addresses, and alternative contact details from public copies, but this is a statutory exemption from the default transparency.

Intellectual property law. The Regulations do not create trade mark rights. The note to reg 4(1)(b) warns that a domain name form may be prevented from use by a third party - such as a trade mark owner. The safe harbour only applies if the entity is “not prevented” from using the domain name. That prevention could arise under the Trade Marks Act 1995, the Competition and Consumer Act 2010 (misleading conduct), or domain name dispute resolution policies. The Regulations do not supersede those laws; they merely withhold the business names offence.

Anti‑money laundering and counter‑terrorism financing (AML/CTF). The requirement to make all Register details available to government bodies (reg 11) includes AUSTRAC and other agencies. The business names register is a source of beneficial ownership information. Although the Regulations do not directly impose AML obligations, the exposure of alternative contact details and home addresses to government bodies supports KYC checks.

Administrative law. Decisions made under the delegated powers (reg 13) are reviewable under the Administrative Decisions (Judicial Review) Act, unless excluded. The name availability decisions under the Determination remain reviewable. The Regulations do not create a merits review right, but the Act does (s 32 provides for review of cancellation decisions). Regulation 7(1)(h) and 10(1)(h) require ASIC to record whether an application for review has been lodged - a transparency measure that interacts with the Administrative Appeals Tribunal process.

The Regulations were originally made in 2011. The only amendment specifically mentioned in the current text is the Business Names Registration Amendment (Delegation and Notified Register) Regulations 2018. Regulation 16 is an application and saving provision relating to that amendment. It states that item 1 of Schedule 1 to the 2018 amending regulations (which inserted or amended reg 13) applies to applications made under s 32(3) of the Act on or after the commencement of that item. Section 32(3) concerns applications for review of a decision to cancel registration - so the 2018 amendment expanded or clarified delegation of that power. Regulation 16(2) also states that the amendment does not affect the continuity of any existing instrument of delegation under s 80(1) - i.e., existing delegations remain valid.

The text does not disclose whether there have been other amendments. Based on the source, we can only comment on the 2018 amendment. The 2018 amendment also likely affected the notified successor details (reg 8) because the amending regulation’s name references “Delegation and Notified Register”. The current reg 8 lists details such as “the way in which the notified successor is expected to inherit assets” and “relationship of the notified successor to the deceased person” - these may have been added or clarified in 2018. The source does not provide a version history, so we must note only what is apparent.

Regulation 13 originally referred to the Minister’s powers under certain subsections of the Act. The 2018 amendment inserted paragraph (b) relating to the Availability of Names Determination. The effect is that ASIC can now make name‑availability decisions for individual entities or business names, not just the Minister.

The regulations were made under s 6(1) of the Act, which allows the Governor‑General to make regulations prescribing matters required or permitted by the Act, or necessary or convenient for carrying out or giving effect to the Act. Regulation 15 modifies the Act by reference to Schedule 1 (not reproduced in the source). That modification power under s 6(2) may have been exercised at the time of initial making or later.

No other amendment history is traceable from the source. Practitioners should check the Federal Register of Legislation for the compilation date and list of amendments. The version provided is likely a compilation, but the user did not supply the date. Given that the Regulations remain in force and the 2018 amendments are the only ones referenced, it is probable that there have been no further substantive amendments.

The source text contains no references to any court cases, judgments, or litigation. The Regulations themselves are procedural and technical - they define exceptions and details, not primary rights. Litigation under the Act is more likely to concern the substantive requirements (e.g. whether a name is deceptively similar, or whether a person was carrying on business). The Regulations’ provisions on domain name variants and register access have not, based on this source, been the subject of reported judicial consideration. The note examples in the Regulations illustrate possible factual scenarios (e.g. one entity owning “fredsfish.com.au” and another “fredsfish.org”) but the courts have not interpreted those notes.

It is possible that disputes over ASIC’s refusal to include or excise certain details from the Register could arise under administrative law, but the source does not disclose any such cases. The delegation power (reg 13) might be challenged if a delegate acts beyond authority, but again no specific litigation is mentioned.

Given the absence of cited cases, the deep dive must note that the Regulations have not generated significant reported litigation. This is consistent with their nature as secondary legislation that mainly clarifies the scope of offences and privacy protections. Most business name disputes likely settle at the ASIC level (objections to name registration) or involve trade mark or passing off claims outside the Regulations. Practitioners should be aware that the Regulations are largely untested in court, so the scope of “prevented from using” a domain name (reg 4(1)(b)) and the precise meaning of “alternative contact details” remain open to judicial interpretation.

Domain name variant trap. The safe harbour in reg 4(1)(b) requires that the entity is “not prevented from using as a domain name” the domain name form. The note gives the example of a third party owning “fredsfish.org” - the entity is prevented from using that domain name because the third party controls it. But prevention can also arise from a contractual term in a domain name registration agreement (e.g. no sub‑licensing), a court order (e.g. a trade mark injunction), or even a cease‑and‑desist letter that creates a real risk. An entity that blithely uses “fredsfish.com” without checking its rights could still be committing the s 18(1) offence if a court later finds it was “prevented” at the time of use. The term “prevented” is not defined in the Regulations or the Act; a court may adopt a broad interpretation (including equitable or legal impediment). Entities should document their right to use each domain name variant.

Host name and domain extension stripping is not reversible. Regulation 4(2) allows removing host names or domain extensions from a domain name that is the registered business name. For example, from “www.shop.fredsfish.com.au” you can strip “www” and “shop” (host names) to get “fredsfish.com.au”, or strip “.com.au” (domain extension) to get “fredsfish”. But the note says “net, org and com are domain extensions.” This means you cannot strip the “.com” from “fredsfish.com.au” to get “fredsfish.au” unless “.au” is also a domain extension. The logic is cumulative: you can only strip host names and top‑level domain extensions. Stripping a second‑level domain (like “.com” from “.com.au”) might produce a name that is not within the exception. The notes are only examples, so careful legal advice is needed for multi‑part domains.

Alternative contact details are not truly private from government. An entity that provides alternative contact details (e.g. a personal mobile number) thinking ASIC will keep them confidential may be unaware that reg 11 requires ASIC to make all Register details available to government bodies and intelligence agencies. There is no carve‑out for alternative contact details - they are included in “all details recorded in the Register”. The entity should assume that any information given voluntarily could end up with any Australian government agency.

Home address truncation is not absolute. While reg 10(2) limits public disclosure to suburb and state/territory for home addresses, this protection is bypassed by reg 11 for government bodies. Moreover, reg 9(c) says the home address is excised from copies given to any person - but that applies only when a person requests a copy of an entry under s 60 of the Act. If the information is obtained from another source (e.g. a property title search), the Regulations do not protect it. Also, if the individual provides a non‑home address as their principal place of business, reg 10(2) does not apply - the full address appears publicly.

Notified successor details are more intrusive than expected. An individual nominated as a notified successor must provide details about how they will “inherit assets used by a deceased person in carrying on a business” and their “relationship to the deceased person” (reg 8(c) and (d)). These are not publicly available (reg 9(e)), but they are recorded on the Register and shared with government bodies. A family member who is not comfortable revealing the nature of their inheritance may need to consider whether nomination is worth it.

Notice to deregistered companies goes to former directors. Under reg 14 item 2, if a company was deregistered without being wound up, ASIC gives notice of business name matters to persons who were directors immediately before deregistration. This means a director who thought they were free of the company’s obligations could receive a notice requiring action (e.g. to object to cancellation of the business name). Failure to respond could result in loss of the name without input. Former directors should maintain current contact addresses.

Seven‑year document retention period. Regulation 12 requires ASIC to keep documents for seven years before destroying them. This means any document submitted to ASIC (e.g. change of details forms, notifications) remains on file for that period. If an entity later disputes an ASIC action, it may rely on those documents, but equally, ASIC can produce them in enforcement proceedings. There is no provision for earlier destruction upon request.

No central registry of domain names. The Regulations rely on the entity holding a domain name registration - but they do not require ASIC to verify domain ownership. The entity must self‑assess. If the domain registration expires, the safe harbour lapses immediately. An entity that uses a domain name after expiry, even inadvertently, loses protection.

Step 1: Register the business name. The Regulations only benefit an entity that has a business name registered under the Act. If the name is not registered, none of the exceptions apply. The entity must apply through ASIC Connect or the Business Registration Service, providing all required details (s 23 of the Act). The Regulations do not affect this initial step.

Step 2: Decide whether to trade under a domain name variant. If the entity wishes to use a domain name that is not its exact registered name (e.g. “fredsfish.com.au” instead of “Fred’s Fish”), it must ensure:

• The domain name form is registered to the entity (e.g. the entity holds the domain registration).
• The entity is not prevented from using that domain name - check for trade marks contracts, court orders, or third‑party rights. Keep a record of the domain registration and a declaration of no known impediments.
• If using a name obtained by stripping host names or domain extensions, verify that the stripping yields a name that is still within the safe harbour (only remove host names and top‑level domain extensions; do not remove core words).

Step 3: Use the domain variant in written communications. In invoices, purchase orders, receipts, business letters, and advertisements, the entity may include the domain name form (or stripped variant) in place of the registered name. But the document must be “connected with carrying on the business under the name” - if the document relates to a different trade, the exception may not cover it. Best practice: include both the registered business name and the domain name to avoid confusion.

Step 4: Display the name at public premises. If the entity has a physical location open to the public (shop, office, market stall), it must prominently display either the domain name form or the stripped variant. The display must be at every such location. “Prominent” means legible and visible from the public thoroughfare. An online‑only business with no public premises does not need to display anything, but if it later opens a pop‑up store, the display requirement activates.

Step 5: Manage personal information. Individual business owners should:

• Provide a business address (e.g. a PO Box or registered office) as the principal place of business if privacy is a concern. Using a home address subjects it to public disclosure (suburb and state/territory) and full disclosure to government bodies.
• Consider whether to provide alternative contact details. These are not publicly available, but they are available to government agencies. If the entity wants a private communication channel with ASIC, alternative contact details are useful. If not, do not provide them - they are optional.
• Notify ASIC if the entity changes its address or contact details to keep the Register accurate; the Act requires updates (s 24), and the Regulations impose no additional requirements.

Step 6: Notified successors. If a person is nominated as a notified successor, they must provide the prescribed details under reg 8. They should be prepared to disclose their relationship to the deceased and the expected method of asset inheritance. Those details will be on the Register but not publicly disclosed. The nomination is voluntary - no one is forced to accept nomination. If privacy concerns outweigh the benefit of securing the business name, the person should decline nomination.

Step 7: Monitor domain name registrations. Because the domain name form safe harbour depends on the entity holding the domain registration, the entity must renew domain names before expiry and maintain ownership. If the domain name is allowed to lapse, the exception falls away. Similarly, if the entity receives a cease‑and‑desist letter or court order preventing use of the domain, it must stop using that variant immediately or risk the offence applying.

Step 8: Respond to ASIC notices. If the entity receives a notice from ASIC regarding cancellation or renewal, the Regulations do not change the underlying deadlines. However, if the entity has ceased to exist (e.g. a deregistered company), the persons listed in reg 14 (former directors, liquidators, nominated contacts) should respond on its behalf to preserve the business name.

Step 9: Maintain records. Keep copies of domain registration certificates, any licences or consents to use the domain, and correspondence with ASIC about the business name. The limitation period for prosecutions under the Act is not specified in the Regulations, but the seven‑year document retention period in reg 12 suggests ASIC may investigate matters up to seven years old. Entities should retain records for at least that long.

Step 10: Check for state‑based suppression. If the business name was originally registered under a state or territory scheme, check whether any personal information was suppressed under that regime (e.g. a home address was not publicly listed). Under the transitional provisions (noted in reg 9), that suppression continues. An entity that believes its information should not be publicly available should confirm with ASIC that the suppression flag is active.